Per-module role: viewer (read) · editor (read + write) · manager (+ delete / sign / approve) · admin (full control of that module). A user tagged legacy has no matrix yet and keeps full access until you save a row. Global role admin is a super-admin across every module. Pick a preset (in the Add dialog, or the dropdown on a row) to fill every dropdown at once — then review and save.